CVE-2026-12339

A Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to be overwritten on the underlying system, affecting system integrity and availability.

CVSS 4.0

6.9CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

EPSS

0.5% chance of exploitation in the next 30 days; higher than 44% of CVEs (scores of 2026-10-25)

CWE

CWE-22

Published

2026-08-10

Modified

2026-10-23

Record from

the NVD, synced 2026-10-24

References

• https://www.tp-link.com/en/support/download/archer-mr200/v7/#Firmware
• https://www.tp-link.com/en/support/download/archer-mr600/v2/#Firmware
• https://www.tp-link.com/en/support/download/tl-mr100/v3.20/#Firmware
• https://www.tp-link.com/en/support/download/tl-mr150/v3.20/#Firmware
• https://www.tp-link.com/en/support/download/tl-mr6400/v5.30/#Firmware

Check your stackJSON